What the security audit checks
Nine themes, within the scope announced before it starts. Depending on the project, some points matter more than others.
Domain and certificates
- HTTPS and forced redirect
- DNSSEC and CAA record
- Needlessly exposed subdomains
- Domain e-mail: SPF, DKIM, DMARC
Access and accounts
- Who has access to what
- Passwords and two-factor authentication
- Default or forgotten accounts
- Admin session length
Code and secrets
- Keys in the code or in the repository history
- Keys exposed in the browser
- Vulnerable dependencies
- PHP, CMS and plugin versions where used
Forms and APIs
- Server-side validation
- Anti-spam and anti-bot
- API routes left open by mistake
- Request limits
- Payment and third-party webhooks
- Error pages with no technical trace
Headers and protections
- Security headers (CSP and others)
- Technology shown to visitors
- Firewall and attack protection
Database
- Row-level security (RLS), enabled and tested
- Admin key never in the browser
- Business constraints set in the database
- No hand-assembled SQL queries
Backups and recovery
- Automatic backup
- Copy kept off the main server
- Alert if a backup fails
- Restore test
- Retention period actually applied
Monitoring and incidents
- Alert if the site goes down or a payment fails
- Incident procedure known and written down
Personal data
- Data collected
- Privacy policy matching reality
- Processing register and data processing agreement (DPA) where needed
- 01A written report: each finding is ranked by severity (critical, high, medium, low), with the evidence, the concrete risk and the recommended fix
- 02A fix plan in priority order
- 03A review session to go through the report
We check again after your fixes.
Once the fixes are done, we go back over the points raised to confirm they are resolved. This second pass is included in the €999.
What the €999 security audit includes
- The check of the nine themesWithin the scope announced before it starts.
- A written report ranked by severity
- A fix plan in priority order
- A review session
- A second pass after the fixesTo confirm the points raised are resolved.
- Implementing the fixesPriced separately, on quote. You remain free to entrust it to Kayo or not.
- A penetration test
- Legal advice
How the security audit runs
- 01Scoping and accessScope, deliverable and schedule announced before it starts; read-only access
- 02AnalysisCheck of the nine themes within the announced scope.
- 03FindingsWritten report, fix plan and review session
- 04Second passAfter your fixes, to confirm the points raised
- Read-only access to what is checked: hosting, code repository, database, relevant tools
- The context of your business and of the data you process
The analysis is based on the access and information you provide.
Budget
- Security audit · €999In-depth check, on security only. Payable in one go when ordered.
- Second pass · includedAfter your fixes, to confirm the points raised.
- Fixes · separate quoteYou remain free to entrust them to Kayo or not.
- Implementing the fixes
- Obligation of means
- Analysis based on the access and information provided
- No guarantee that every flaw is ruled out
- Results of the fixes not guaranteed
- The security audit covers security only
- The Digital Audit stays at €125
- The pre-audit stays free
The security audit costs €999, payable in one go when ordered, with the scope announced before it starts. The second pass is included. Implementing the fixes is covered by a separate quote.
Your questions. Our clear answers.
How is it different from the Digital Audit?
The Digital Audit (€125) covers your online presence as a whole: site, visibility, tools, journeys. The security audit (€999) covers security only, but in much more depth.
How do I request a security audit?
Book the 20-minute call: we agree on the scope, the deliverable and the schedule together, then the €999 price is announced before it starts.
What does the report contain?
Each finding is ranked by severity (critical, high, medium, low), with the evidence, the concrete risk and the recommended fix. A fix plan in priority order comes with it, and a review session lets us go through it.
What is the second pass?
After your fixes, we go back over the points raised to confirm they are resolved. It is included in the €999.
Who makes the fixes?
They are priced separately, on quote. You remain free to entrust them to Kayo or not.
What do you need from us?
Read-only access to what is checked (hosting, code repository, database, relevant tools), along with the context of your business and of the data you process.
Is it a penetration test?
No. A penetration test is not included in the security audit.
Does an audit guarantee there is no flaw?
No. We are bound by an obligation of means: the analysis is based on the access and information provided, and no check guarantees absolute protection.
When do we get the report?
The schedule is announced with the scope and the deliverable, before it starts.
How do I pay for the audit?
€999, payable in one go when ordered, like the Digital Audit.